Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Leap:15.5:Update
openvpn.23378
openvpn-CVE-2022-0547.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File openvpn-CVE-2022-0547.patch of Package openvpn.23378
From 282ddbac54f8d4923844f69983b38dd2b813a00a Mon Sep 17 00:00:00 2001 From: David Sommerseth <davids@openvpn.net> Date: Sun, 13 Mar 2022 20:31:53 +0100 Subject: [PATCH] plug-ins: Disallow multiple deferred authentication plug-ins The plug-in API in OpenVPN 2.x is not designed for running multiple deferred authentication processes in parallel. The authentication results of such configurations are not to be trusted. For now we bail out when this is discovered with an error in the log. CVE: 2022-0547 Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20220313193154.9350-3-openvpn@sf.lists.topphemmelig.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23931.html Signed-off-by: Gert Doering <gert@greenie.muc.de> --- doc/man-sections/plugin-options.rst | 9 ++++++++ src/openvpn/plugin.c | 33 ++++++++++++++++++++++++++--- 2 files changed, 39 insertions(+), 3 deletions(-) --- src/openvpn/plugin.c.orig +++ src/openvpn/plugin.c @@ -806,7 +806,7 @@ plugin_call_ssl(const struct plugin_list const int n = plugin_n(pl); bool success = false; bool error = false; - bool deferred = false; + bool deferred_auth_done = false; setenv_del(es, "script_type"); envp = make_env_array(es, false, &gc); @@ -831,7 +831,34 @@ plugin_call_ssl(const struct plugin_list break; case OPENVPN_PLUGIN_FUNC_DEFERRED: - deferred = true; + if ((type == OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY) + && deferred_auth_done) + { + /* + * Do not allow deferred auth if a deferred auth has + * already been started. This should allow a single + * deferred auth call to happen, with one or more + * auth calls with an instant authentication result. + * + * The plug-in API is not designed for multiple + * deferred authentications to happen, as the + * auth_control_file file will be shared across all + * the plug-ins. + * + * Since this is considered a critical configuration + * error, we bail out and exit the OpenVPN process. + */ + error = true; + msg(M_FATAL, + "Exiting due to multiple authentication plug-ins " + "performing deferred authentication. Only one " + "authentication plug-in doing deferred auth is " + "allowed. Ignoring the result and stopping now, " + "the current authentication result is not to be " + "trusted."); + break; + } + deferred_auth_done = true; break; default: @@ -855,7 +882,7 @@ plugin_call_ssl(const struct plugin_list { return OPENVPN_PLUGIN_FUNC_ERROR; } - else if (deferred) + else if (deferred_auth_done) { return OPENVPN_PLUGIN_FUNC_DEFERRED; }
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor